Oracle Portal Server Security

Enhancing Java Portlets 7-43

7.2.7.8 HTTPS Communication

Normal communication between Oracle Portal and a provider uses HTTP, a network protocol that transmits data as plain text using TCP as the transport layer. HTTPS uses an extra secured layer SSL on top of TCP to secure communication between a client and a server, making it difficult to intercept and read messages. Each entity for example, an Oracle Web Cache instance receiving a communication using SSL has a freely available public key and a private key known only to the entity itself. Any messages sent to an entity are encrypted with its public key. A message encrypted by the public key may only be decrypted by the private key so that, even if a message is intercepted by a felonious third party, it cannot be decrypted. Certificates used to sign communications ensure that the public key does in fact belong to the correct entity. These are issued by trusted third parties, known as Certification Authorities CA. They contain an entitys name, public key, and other security credentials and are installed on the server end of an SSL communication to verify the identity of the server. Client certificates may also be installed on the client to verify the identity of a client. Oracle Wallet Manager manages public key security credentials. It generates public and private key pairs, creates a certificate request to a CA, and installs the certificate on a server. For more information on this topic, refer to the Oracle Fusion Middleware Administrators Guide for Oracle Portal. Configuration of SSL When a provider is registered from an Oracle Portal instance, only one URL is entered, which means either HTTP or HTTPS may be used but not both. Each port on each server that may be used to receive SSL messages must have a server-side certificate installed that is, an OracleAS Web Cache instance in front of the Web provider and the server that hosts the provider. The certificate installed on a server port ensures that communication between two points is encrypted but does not authenticate the source of a message. Message authentication should be used as well to fully secure communication between a trusted Oracle Portal instance and a provider. For more information about SSL configuration for Oracle Portal, refer to the Oracle Fusion Middleware Administrators Guide for Oracle Portal.

7.2.7.9 LDAP Oracle Internet Directory Security

PDK-Java uses Portlet Security Managers for LDAP Oracle Internet Directory security. PDK-Java uses Oracle Internet Directory as a repository of users, groups, and permissions. It retrieves information about the logged-in user and determines whether the user has the required permissions to view the portlet and data within the portlet. By enabling Oracle Internet Directory security, your providers perform the following: ■ Secure portlets based on groups. ■ Restrict access to the administrative functions of your portlets using your own security manager. ■ Retrieve all of the user property information stored in the Oracle Internet Directory including first name, last name, title, e-mail, telephone number, groups, and photo. ■ Create users and groups for Oracle Portal.